CVE-2026-34042 (GCVE-0-2026-34042)

Vulnerability from cvelistv5 – Published: 2026-03-31 01:46 – Updated: 2026-03-31 18:53
VLAI?
Title
act: actions/cache server allows malicious cache injection
Summary
act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86.
Severity ?
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
nektos act Affected: < 0.2.86
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34042",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T18:50:28.267177Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T18:53:13.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "act",
          "vendor": "nektos",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.2.86"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "act is a project which allows for local running of github actions. Prior to version 0.2.86, act\u0027s built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T01:46:15.747Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825"
        },
        {
          "name": "https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7"
        },
        {
          "name": "https://code.forgejo.org/forgejo/runner/issues/294",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://code.forgejo.org/forgejo/runner/issues/294"
        },
        {
          "name": "https://github.com/nektos/act/releases/tag/v0.2.86",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nektos/act/releases/tag/v0.2.86"
        }
      ],
      "source": {
        "advisory": "GHSA-x34h-54cw-9825",
        "discovery": "UNKNOWN"
      },
      "title": "act: actions/cache server allows malicious cache injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34042",
    "datePublished": "2026-03-31T01:46:15.747Z",
    "dateReserved": "2026-03-25T15:29:04.745Z",
    "dateUpdated": "2026-03-31T18:53:13.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34042",
      "date": "2026-04-24",
      "epss": "0.0002",
      "percentile": "0.0539"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34042\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-31T03:15:58.220\",\"lastModified\":\"2026-04-16T14:45:19.723\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"act is a project which allows for local running of github actions. Prior to version 0.2.86, act\u0027s built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86.\"},{\"lang\":\"es\",\"value\":\"act es un proyecto que permite la ejecuci\u00f3n local de acciones de GitHub. Antes de la versi\u00f3n 0.2.86, el servidor actions/cache integrado de act escucha las conexiones en todas las interfaces y permite que cualquiera que pueda conectarse a \u00e9l, incluyendo a alguien desde cualquier lugar de internet, cree cach\u00e9s con claves arbitrarias y recupere todos los cach\u00e9s existentes. Si pueden predecir qu\u00e9 claves de cach\u00e9 ser\u00e1n utilizadas por las acciones locales, pueden crear cach\u00e9s maliciosos que contengan los archivos que deseen, lo que muy probablemente permitir\u00eda la ejecuci\u00f3n remota de c\u00f3digo arbitrario dentro del contenedor de Docker. Este problema ha sido parcheado en la versi\u00f3n 0.2.86.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://code.forgejo.org/forgejo/runner/issues/294\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nektos/act/releases/tag/v0.2.86\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34042\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-31T18:50:28.267177Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-31T18:50:29.289Z\"}}], \"cna\": {\"title\": \"act: actions/cache server allows malicious cache injection\", \"source\": {\"advisory\": \"GHSA-x34h-54cw-9825\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"nektos\", \"product\": \"act\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.2.86\"}]}], \"references\": [{\"url\": \"https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825\", \"name\": \"https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7\", \"name\": \"https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://code.forgejo.org/forgejo/runner/issues/294\", \"name\": \"https://code.forgejo.org/forgejo/runner/issues/294\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nektos/act/releases/tag/v0.2.86\", \"name\": \"https://github.com/nektos/act/releases/tag/v0.2.86\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"act is a project which allows for local running of github actions. Prior to version 0.2.86, act\u0027s built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-31T01:46:15.747Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34042\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-31T18:53:13.564Z\", \"dateReserved\": \"2026-03-25T15:29:04.745Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-31T01:46:15.747Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.